| Package | Affected versions | Patched versions |
|---|---|---|
| http server | ≥ 2.4.34, ≤ 2.4.38 | |
| communications session report manager | = 8.0.0= 8.1.0= 8.1.1= 8.2.0 | |
| communications session route manager | = 8.0.0= 8.1.0= 8.1.1= 8.2.0 | |
| enterprise manager ops center | = 12.3.3= 12.4.0 | |
| http server | = 12.2.1.3.0 | |
| instantis enterprisetrack | = 17.1= 17.2= 17.3 | |
| retail xstore point of service | = 7.0= 7.1 | |
| jboss core services | = 1.0 |
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free